full-disclosure - Re: cloning PC / run in VMware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 25 Jul 2006 16:24:53 +0200
From: endrazine <endrazine@...il.com>
To: indianz@...ianz.ch, full-disclosure@...ts.grok.org.uk
Cc: 
Subject: Re: cloning PC / run in VMware

indianz@...ianz.ch wrote:
> Hi there
>
> Thanx for information... Will try my best :)
>
> Have a nice day,
> GreetZ from IndianZ
>
>
>   
>>>> Don't tell me a simple greyed out checkbox can stop you ...
>>>>         
>>> ^---> foudstone's showwin.exe usually does the trick
>>>       
>> Actually, it's a bit harder.
>>
>> At export time, the Crypto provider will check the "non exportable"
>> flag, even if you have "ungreyed" the checkbox.
>>
>> >From here you have 2 choices :
>>
>> - Searching for the private key blob in the process memory.
>>
>> - Patching the Crypto provider to kill the check (harder, because of WFP
>> and some internal checksums inside Crypto providers - e.g. RSAENH.DLL).
>>     

if you're ready to do some reverse engineering, then editing the
resources of the app would be better than using showwin.
if they took the time to add checksums, the first solution you mentioned
will prolly be faster.
</my two cents>

>> I have not heard of any readily usable code on the Internet, but looking
>> at the slides it should not be too hard to reproduce.
>>
>> Regards,
>> - Nicolas RUFF
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>>     
>
>
> GreetZ from IndianZ
>
> mailto:indianz@...ianz.ch
> http://www.indianz.ch
>
>
>   

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/